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WHAT IS CLAIMED IS: 

1 1 . A method for handling packets, comprising: 

2 performing preliminary multi-protocol frame classification for incoming frames; 

3 processing at least the incoming frame and the preliminary multi-protocol 

4 frame classification to provide parsing instructions; and 

5 providing multi-stage parsing of the incoming frame according to the parsing 

6 instructions to generate search results presenting information about the incoming 

7 frame. 

1 2. The method of claim 1 wherein the performing preliminary multi- 

2 protocol frame classification further comprises resolving a composition for the 

3 incoming frame. 

1 3. The method of claim 1 wherein the processing further comprises: 

2 storing an incoming frame in a memory buffer; 

3 generating the parsing instructions for the incoming frame based upon the 

4 multi-protocol frame classification; and 

5 aligning the generated parsing instructions with frame data selected from the 

6 incoming frames stored in the memory buffer. 
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1 4. The method of claim 1 wherein the providing multi-stage parsing of the 

2 incoming frame further comprises: 

3 reading at least a portion of the incoming frame from a memory buffer; 

4 interpreting the parsing instructions; and 

5 executing macros for performing parsing functions on at least the portion of 

6 the incoming frame using the interpreted parsing instructions. 

1 5. The method of claim 1 wherein the providing multi-stage parsing of the 

2 incoming frame further comprises: 

3 generating extractions instructions in response to the at least incoming frame 

4 and the preliminary multi-protocol frame classification; 

5 using the extraction instructions to produce search queries; and 

6 applying the search queries against a memory to produce the search results. 

1 6. The method of claim 5 wherein the using the extraction instructions 

2 further comprises conditional extraction. 

1 7. The method of claim 6 wherein conditional extraction comprises 

2 determining whether extracted bits of data from the packet meet a predetermined 

3 criteria. 
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1 8. The method of claim 5 wherein the providing multi-stage parsing of the 

2 incoming frame further comprises: 

3 reprocessing the search results to generate refined parsing instructions; and 

4 parsing of the incoming frame according to the refined parsing instructions to 

5 generate refined search results, the refined search results providing greater 

6 information about the incoming frame. 

1 9. The method of claim 1 wherein the providing multi-stage parsing of the 

2 incoming frame further comprises: 

3 reprocessing the search results to generate refined parsing instructions; and 

4 parsing of the incoming frame according to the refined parsing instructions to 

5 generate refined search results, the refined search results providing greater 

6 information about the incoming frame. 

1 10. The method of claim 1 wherein the processing at least the incoming 

2 frame and the preliminary multi-protocol frame classification further comprises 

3 processing the search results, the incoming frame and the preliminary multi-protocol 

4 frame classification to provide refined parsing instructions. 

1 11. The method of claim 1 wherein the parsing instructions comprise a 

2 location identifier and an associated instruction to be applied to the frame at the 

3 position identified by the location identifier. 
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1 12. The method of claim 1 wherein the frame comprises one of a plurality 

2 of frame protocols, the performing preliminary multi-protocol frame classification 

3 further comprising classifying a protocol identity. 

1 13. The method of claim 1 wherein the performing preliminary multi- 

2 protocol frame classification further comprises identifying each layer protocol and 

3 writing the frame into memory along with a protocol layer code. 

1 14. The method of claim 13 wherein providing multi-stage parsing of the 



2 incoming frame further comprises using the protocol layer code as a start vector into 

3 an instruction memory, the instruction memory containing instructions for parsing the 

4 frame and pointers to access selected words of the frame in a frame buffer. 

1 1 5. The method of claim 14 wherein the performing preliminary multi- 

2 protocol frame classification further comprises identifying each layer protocol and 

3 writing the frame into memory along with a protocol layer code, the method further 

4 comprising processing the instructions from the instruction memory, resolving the 

5 pointers according to the protocol layer table and aligning the frame data with the 

6 instruction words. 

1 16. The method of claim 14 wherein the search results are fed back to an 

2 instruction controller to be used as data that a parsing engine can parse through a 

3 data pipe. 
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1 17. The method of claim 1 wherein the memory comprises a content 

2 addressable memory and the search queries are used to search the content 

3 addressable memory. 

1 18. The method of claim 1 wherein the memory comprises a static random 

2 access memory and the search queries are indexed directly to a static random 

3 access memory. 

1 19. The method of claim 1 further comprising providing a parser instruction 

2 set in the instruction memory to define microcode used for generating the parser 

3 instructions. 

1 20. The method of claim 1 further comprising forwarding the frame and the 

2 search results. 

1 21 . The method of claim 1 wherein the search results include the frame 

2 classification. 

1 22. The method of claim 16 wherein the search results are fed back to an 

2 instruction controller to be used as a start vector for subsequent processing stages. 

1 23. The method of claim 1 wherein providing multi-stage parsing of the 

2 incoming frame further comprises performing conditional branching, the conditional 

3 branching allowing specific instructions to be performed based upon satisfaction of a 

4 predetermined criteria. 
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1 24. A multi-protocol, multi-stage, real-time frame classifier, comprising: 

2 a preliminary multi-protocol frame composition analyzer for performing 

3 preliminary multi-protocol frame classification for incoming frames; 

4 a parsing instruction generator for processing at least the incoming frame and 

5 the preliminary multi-protocol frame classification to provide parsing instructions; and 

6 a multi-stage parsing engine for providing multi-stage parsing of the incoming 

7 frame according to the parsing instructions to generate search results presenting 

8 information about the incoming frame. 

1 25. The multi-protocol, multi-stage, real-time frame classifier of claim 24 

2 wherein the preliminary multi-protocol frame classifier resolves a composition for the 

3 incoming frame. 

1 26. The multi-protocol, multi-stage, real-time frame classifier of claim 24 

2 wherein the parsing instructions generator processing further comprises: 

3 a memory buffer for storing an incoming frame; 

4 an instruction generator for creating the parsing instructions for the incoming 

5 frame based upon the multi-protocol frame classification; and 

6 a data pipe for aligning the generated parsing instructions with frame data 

7 selected from the incoming frames stored in the frame buffer. 
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1 27. The multi-protocol, multi-stage, real-time frame classifier of claim 24 

2 wherein the multi-stage parsing engine reads at least a portion of the incoming 

3 frame from a memory buffer, interprets the parsing instructions, and executes 

4 macros for performing parsing functions on at least the portion of the incoming frame 

5 using the interpreted parsing instructions. 

1 28. The multi-protocol, multi-stage, real-time frame classifier of claim 24 

2 wherein the multi-stage parsing engine generates extraction instructions in response 

3 to the at least incoming frame and the preliminary multi-protocol frame classification. 

ip 1 29. The multi-protocol, multi-stage, real-time frame classifier of claim 28 

0 2 wherein the multi-stage parsing engine performs conditional extractions using the 

ass 

ii 3 extraction instructions. 

!j 1 30. The multi-protocol, multi-stage, real-time frame classifier of claim 29 

3 2 wherein conditional extraction comprises determining whether extracted bits of data 

3 from the packet meet a predetermined criteria. 

1 31 . The multi-protocol, multi-stage, real-time frame classifier of claim 28 

2 wherein the multi-stage parsing engine further comprises an extractor for using the 

3 extraction instructions to produce search queries and a memory for applying the 

4 search queries against to produce the search results. 
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1 32. The multi-protocol, multi-stage, real-time frame classifier of claim 31 

2 further comprising a feedback path for allowing the search results to be reprocessed 

3 to generate refined parsing instructions that are used by the parsing engine to 

4 generate refined search results, the refined search results providing greater 

5 information about the incoming frame. 

1 33. The multi-protocol, multi-stage, real-time frame classifier of claim 24 

2 wherein the parsing instructions generator processes the search results, the 

3 incoming frame and the preliminary multi-protocol frame classification to provide 
'M 4 refined parsing instructions. 

# 1 34. The multi-protocol, multi-stage, real-time frame classifier of claim 24 

: „ 

| safe 

W 2 wherein the parsing instructions comprise a location identifier and an associated 

3 instruction to be applied to the frame at the position identified by the location 

l i 4 identifier. 

1 35. The multi-protocol, multi-stage, real-time frame classifier of claim 24 

2 wherein the frame comprises one of a plurality of frame protocols, the preliminary 

3 multi-protocol frame classifier classifying the incoming frame to identify a protocol 

4 identity. 

1 36. The multi-protocol, multi-stage, real-time frame classifier of claim 24 

2 wherein the preliminary multi-protocol frame classifier identifies each layer protocol 

3 and writes the frame into memory along with a protocol layer code. 
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1 37. The multi-protocol, multi-stage, real-time frame classifier of claim 36 

2 wherein the multi-stage parsing engine uses the protocol layer code as a start vector 

3 for an instruction memory, the instruction memory containing instructions for parsing 

4 the frame and pointers to access selected words of the frame in a memory buffer. 

1 38. The multi-protocol, multi-stage, real-time frame classifier of claim 37 

2 wherein the parsing instructions generator identifies each layer protocol and writes 

3 the frame into memory along with a protocol layer code and wherein the multi-stage 

4 parsing engine processes the instructions from the instruction memory, resolves the 
5; 5 pointers according to the protocol layer table and aligns the frame data with the 

IS 6 instruction words. 

^ 1 39. The multi-protocol, multi-stage, real-time frame classifier of claim 37 

t 2 wherein the search results are fed back to the parsing instructions generator to be 

J I; 

ri 3 used as data that a parsing engine can parse through a data pipe. 

1 40. The multi-protocol, multi-stage, real-time frame classifier of claim 24 

2 wherein the memory comprises a content addressable memory and the search 

3 queries are used to search the content addressable memory. 

1 41 . The multi-protocol, multi-stage, real-time frame classifier of claim 24 

2 wherein the memory comprises a static random access memory and the search 

3 queries are indexed directly to a static random access memory. 
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1 42. The multi-protocol, multi-stage, real-time frame classifier of claim 24 

2 wherein the parsing instructions generator provides a parser instruction set in an 

3 instruction memory to define microcode used for generating the parser instructions. 

1 43. The multi-protocol, multi-stage, real-time frame classifier of claim 24 

2 wherein the multi-stage parsing engine forwards the frame and the search results. 

1 44. The multi-protocol, multi-stage, real-time frame classifier of claim 24 

2 wherein the search results include the frame classification. 

1 45. The multi-protocol, multi-stage, real-time frame classifier of claim 39 



2 wherein the parsing instructions generator further comprises an instruction controller 

3 and wherein the search results are fed back to the instruction controller to be used 

4 as a start vector for subsequent processing stages. 

1 46. The multi-protocol, multi-stage, real-time frame classifier of claim 24 

2 wherein the multi-stage parsing engine performs conditional branching, the 

3 conditional branching allowing specific instructions to be performed based upon 

4 satisfaction of a predetermined criteria. 
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1 47. An article of manufacture comprising a program storage medium 

2 readable by a computer, the medium tangibly embodying one or more programs of 

3 instructions executable by the computer to perform a method for parsing frames in a 

4 network flow, the method comprising: 

5 performing preliminary multi-protocol frame classification for incoming frames; 

6 processing at least the incoming frame and the preliminary multi-protocol 

7 frame classification to provide parsing instructions; and 

8 providing multi-stage parsing of the incoming frame according to the parsing 

9 instructions to generate search results presenting information about the incoming 
10 frame. 

1 48. The article of manufacture of claim 47 wherein the performing 

2 preliminary multi-protocol frame classification further comprises resolving a 

3 composition for the incoming frame. 

1 49. The article of manufacture of claim 47 wherein the processing further 

2 comprises: 

3 storing an incoming frame in a memory buffer; 

4 generating the parsing instructions for the incoming frame based upon the 

5 multi-protocol frame classification; and 

6 aligning the generated parsing instructions with frame data selected from the 

7 incoming frames stored in the memory buffer. 
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1 50. The article of manufacture of claim 47 wherein the providing multi- 

2 stage parsing of the incoming frame further comprises: 

3 reading at least a portion of the incoming frame from a memory buffer; 

4 interpreting the parsing instructions; and. 

5 executing macros for performing parsing functions on at least the portion of 

6 the incoming frame using the interpreted parsing instructions. 

1 51 . The article of manufacture of claim 47 wherein the providing multi- 

2 stage parsing of the incoming frame further comprises: 

3 generating extractions instructions in response to the at least incoming frame 

4 and the preliminary multi-protocol frame classification; 

5 using the extraction instructions to produce search queries; and 

6 applying the search queries against a memory to produce the search results. 

1 52. The article of manufacture of claim 51 wherein the using the extraction 

2 instructions further comprises conditional extraction. 

1 53. The article of manufacture of claim 52 wherein conditional extraction 

2 comprises determining whether extracted bits of data from the packet meet a 

3 predetermined criteria. 
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1 54. The article of manufacture of claim 51 wherein the providing multi- 

2 stage parsing of the incoming frame further comprises: 

3 reprocessing the search results to generate refined parsing instructions; and 

4 parsing of the incoming frame according to the refined parsing instructions to 

5 generate refined search results, the refined search results providing greater 

6 information about the incoming frame. 

1 55. The article of manufacture of claim 47 wherein the providing multi- 

2 stage parsing of the incoming frame further comprises: 

jf 3 reprocessing the search results to generate refined parsing instructions; and 

K 4 parsing of the incoming frame according to the refined parsing instructions to 

!i. 5 generate refined search results, the refined search results providing greater 

6 information about the incoming frame. 



56. The article of manufacture of claim 47 wherein the processing at least 



2 2 the incoming frame and the preliminary multi-protocol frame classification further 

3 comprises processing the search results, the incoming frame and the preliminary 

4 multi-protocol frame classification to provide refined parsing instructions. 

1 57. The article of manufacture of claim 47 wherein the parsing instructions 

2 comprise a location identifier and an associated instruction to be applied to the 

3 frame at the position identified by the location identifier. 
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1 58. The article of manufacture of claim 47 wherein the frame comprises 

2 one of a plurality of frame protocols, the performing preliminary multi-protocol frame 

3 classification further comprising classifying a protocol identity. 

1 59. The article of manufacture of claim 47 wherein the performing 

2 preliminary multi-protocol frame classification further comprises identifying each 

3 layer protocol and writing the frame into memory along with a protocol layer code. 

1 60. The article of manufacture of claim 59 wherein providing multi-stage 



2 parsing of the incoming frame further comprises using the protocol layer code as a 

3 start vector into an instruction memory, the instruction memory containing 

4 instructions for parsing the frame and pointers to access selected words of the frame 

5 in a memory buffer. 

1 61 . The article of manufacture of claim 60 wherein the performing 

2 preliminary multi-protocol frame classification further comprises identifying each 

3 layer protocol and writing the frame into memory along with a protocol layer code, 

4 the method further comprising processing the instructions from the instruction 

5 memory, resolving the pointers according to the protocol layer table and aligning the 

6 frame data with the instruction words. 

1 62. The article of manufacture of claim 60 wherein the search results are 

2 fed back to an instruction controller to be used as data that a parsing engine can 

3 parse through a data pipe. 
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1 63. The article of manufacture of claim 47 wherein the memory comprises 

2 a content addressable memory and the search queries are used to search the 

3 content addressable memory. 

1 64. The article of manufacture of claim 47 wherein the memory comprises 

2 a static random access memory and the search queries are indexed directly to a 

3 static random access memory. 

1 65. The article of manufacture of claim 47 further comprising providing a 

2 parser instruction set in the instruction memory to define microcode used for 

3 generating the parser instructions. 

1 66. The article of manufacture of claim 47 further comprising forwarding 

2 the frame and the search results. 

1 67. The article of manufacture of claim 47 wherein the search results 

2 include the frame classification. 

1 68. The article of manufacture of claim 62 wherein the search results are 

2 fed back to an instruction controller to be used as a start vector for subsequent 

3 processing stages. 

1 69. The article of manufacture of claim 47 wherein providing multi-stage 



2 parsing of the incoming frame further comprises performing conditional branching, 

3 the conditional branching allowing specific instructions to be performed based upon 

4 satisfaction of a predetermined criteria. 

Page 46 

ALG 1305.4US01 
Patent Application 



47 



1 70. A method for handling packets, comprising: 

2 performing preliminary multi-protocol frame classification for incoming frames; 

3 processing at least the incoming frame and the preliminary multi-protocol 

4 frame classification to provide parsing instructions; and 

5 providing parsing of the incoming frame according to the parsing instructions 

6 to generate search results presenting information about the incoming frame. 

1 71 . A method for handling packets, comprising: 

2 processing at least the incoming frame to provide parsing instructions; and 

3 providing multi-stage parsing of the incoming frame according to the parsing 

4 instructions to generate search results presenting information about the incoming 

5 frame. 

1 72. An article of manufacture comprising a program storage medium 

2 readable by a computer, the medium tangibly embodying one or more programs of 

3 instructions executable by the computer to perform a method for parsing frames in a 

4 network flow, the method comprising: 

5 performing preliminary multi-protocol frame classification for incoming frames; 

6 processing at least the incoming frame and the preliminary multi-protocol 

7 frame classification to provide parsing instructions; and 

8 providing parsing of the incoming frame according to the parsing instructions 

9 to generate search results presenting information about the incoming frame. 
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1 73. An article of manufacture comprising a program storage medium 

2 readable by a computer, the medium tangibly embodying one or more programs of 

3 instructions executable by the computer to perform a method for parsing frames in a 

4 network flow, the method comprising: 

5 processing at least the incoming frame to provide parsing instructions; and 

6 providing multi-stage parsing of the incoming frame according to the parsing 

7 instructions to generate search results presenting information about the incoming 

8 frame. 

1 74. A multi-protocol, multi-stage, real-time frame classifier, comprising: 

2 a preliminary multi-protocol frame composition analyzer for performing 

3 preliminary multi-protocol frame classification for incoming frames; 

4 a parsing instruction generator for processing at least the incoming frame and 

5 the preliminary multi-protocol frame classification to provide parsing instructions; and 

6 a parsing engine for providing multi-stage parsing of the incoming frame 

7 according to the parsing instructions to generate search results presenting 

8 information about the incoming frame. 

1 75. A multi-protocol, multi-stage, real-time frame classifier, comprising: 

2 a parsing instruction generator for processing an incoming frame to provide 

3 parsing instructions; and 

4 a multi-stage parsing engine for providing multi-stage parsing of the incoming 

5 frame according to the parsing instructions to generate search results presenting 

6 information about the incoming frame. 
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